CVE-2025-63842 describes an XSS vulnerability in the web backend of Repetico app version 1.9.7.31 for Android. An authenticated remote attacker can exploit this by injecting malicious JavaScript code through the multiple-choice question text field, which is then executed in the app context. This can lead to partial confidentiality and integrity impact but does not affect availability. The vulnerability requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript code in the context of the app, potentially leading to information disclosure and modification of data within the app session. There is no indication of availability impact or active exploitation in the wild.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting authenticated user input where possible and applying input validation or sanitization on the server side.